A CHINESE AI PEN-TESTER RAN THE BREAK-INS ITSELF

GMO Cybersecurity by Ierae, the security arm of Japan's GMO Internet Group, investigated the attack infrastructure behind Japan's autumn breach wave and found ARTEX — an open-source, Chinese-built autonomous penetration-testing tool — running on the attackers' servers. Within what the firm could observe, the infrastructure targeted almost exclusively Japan: about 20 Japanese companies, nine of them sites in the same industry.

Eight of the confirmed targets had already disclosed data breaches in September or October 2026, which GMO says points to one group behind multiple incidents; the findings were shared with law enforcement. Six more AI-driven attack servers were found, each aimed at a specific sector — digital gifts, retail, insurance, finance, e-commerce and logistics — suggesting country- and industry-specific campaigns.

ARTEX hooks large language models up to a penetration-testing framework that plans and carries out reconnaissance, probing and exploitation with little human input. After CrowdStrike tied the tool to a raid on South Korean banks, its developer pulled the public repository on October 8 — but forks and copies of the open-source code remain in circulation.